bpf_check_classic(9)

📦 version 7.3.1, in nixpkgs unstable

💅 bpf_check_classic(9) — from the Kernel API Manual, bestie

okay so picture this: it's a (9) kernel API page, the vibe is very "security guard at the club door," and the function's whole job is checking IDs before the chaos gets in. let's get into it ✨

🌸 NAME 🌸

bpf_check_classic — verify socket filter code. that's it, that's the gig. she checks, she verifies, she slays 🎀

🦋 SYNOPSIS 🦋

int bpf_check_classic (const struct sock_filter *filter , unsigned int
flen );

like yes the line break is ugly, no we are not fixing it, it's canon 💅

💖 ARGUMENTS 💖

  • filter — the filter we're verifying. the main character of the whole operation 🫶
  • flen — length of the filter, aka how many instructions we're dealing with 👑

🔥 DESCRIPTION 🔥

so basically this thing checks the user's filter code. and ngl that is so important, because if we let some ugly filter code slip through — kaboom! 💀 like genuinely, it's giving disaster, it's giving kernel panic energy, we simply cannot.

the filter has to pass the vibe check on all of these, no exceptions:

  • it must contain no references or jumps that are out of range — girl stay in your lane fr fr
  • no illegal instructions — read the rules, bestie 🙈
  • and it must end with a RET instruction. end of story, that's the closer, periodt 💅

also important: all jumps are forward, because they are not signed. so don't come in here trying to jump backwards, that's not the move ⭐

returns 0 if the rule set is legal — she passes, she's iconic, we stan 👑 — or -EINVAL if not 😭

real talk: this is the bouncer, not the decorator. it only verifies. it does not fix your janky filter for you 🙏

🌈 SEE ALSO 🌈

kernel file ./net/core/filter.c — plus these absolute legends:

iykyk 🧚💜

and that's the whole page, bestie!! 🍓 this little cutie lives in ./net/core and she's dated October 2026 — mwah, xoxo, go verify your filters, bpf_check_classic(9) out 💋✨
📦 where this page comes from